Privacy Policy
When you use the BluCory aquarium monitoring and control service, your personal data is processed in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK). This notice explains what data we process, for which purposes and on which legal grounds, who we share it with, and what your rights are. The Turkish version prevails in case of any difference.
1. Data controller
The data controller of your personal data is Ersin KAR (BluCory).
- Country: Türkiye
- Email: [email protected]
- Web: https://blucory.com
2. Personal data we process
We collect data directly from you (sign-up and settings forms), from Google if you choose to sign in with Google, from your BluCory device, and automatically from your browser while you use the app.
| Category | Examples | Source |
|---|---|---|
| Identity | Full name, username | Sign-up form or Google Sign-In |
| Contact | Email address, phone number | Sign-up, email verification and account settings |
| Google account | Google account ID, your name, your email address and whether Google has verified it | Google Sign-In (only if you choose it) |
| Premium membership and payment | Premium end date, promo / card codes you redeem, Google Play subscription status and purchase token. We never receive your card or bank details; payment is handled by Google Play. | You and Google Play |
| Account security | PIN (stored only as a hash), IP address on sign-in and PIN reset attempts, browser details for “remember me” | Sign-in |
| Device and connection | Device ID, pairing date, firmware version, the device’s IP address and Wi-Fi signal strength, Wi-Fi network name and password to be sent to the device | Device and settings |
| Measurement and control data | Temperature, pH and TDS readings, calibration, outlet states, automation and thermostat rules, feeder logs | Device |
| User content | Aquarium details, livestock records, maintenance log and notes, reminders, feeding plan, profile / aquarium / food photos, support messages | What you enter |
| Live stream settings | YouTube channel ID and API key, video code, Twitch username | Settings |
| Preferences | Language, time zone, theme, notification settings | Settings |
| Notifications | Push subscription address and browser / device details | Your browser |
| Usage statistics | Pages opened and time spent, buttons used, how the app was opened, device type, operating system, browser, screen width, notification permission, errors on screen | Your browser (with your explicit consent) |
| AI comments | Comments generated from measurement data and user content | The service |
We do not ask for special categories of personal data (health, biometric, beliefs, etc.). Please do not write such information in notes or messages.
3. Purposes and legal grounds
We process your data only for the purposes below, based on the legal grounds in Article 5 of the KVKK. We do not use it for advertising or marketing and we do not sell it.
| Purpose | Data | Legal ground (KVKK Art. 5/2) |
|---|---|---|
| Creating the account, sign-in and device pairing | Identity, contact, account security, device | Conclusion and performance of a contract (c) |
| Signing up and signing in with Google, verifying the email address | Google account, contact | Conclusion and performance of a contract (c) |
| Managing premium membership and subscriptions | Premium membership and payment | Performance of a contract (c), legal obligation (ç) |
| Showing readings, controlling outlets and the feeder, charts and the log | Measurement and control data, user content, preferences | Performance of a contract (c) |
| Sending alerts and reminders | Notifications, measurement data, preferences | Performance of a contract (c) |
| Account security notifications (PIN / username changed, device reset) | Account security, notifications | Legitimate interest (f) |
| PIN reset and technical support | Contact, support messages | Performance of a contract (c) |
| Generating aquarium comments with AI | Measurement data, user content (name, email and phone are not sent) | Performance of a contract (c) |
| Preventing misuse and unauthorized access | IP address, sign-in attempts | Legitimate interest (f) |
| Usage statistics to improve the service | Usage statistics | Explicit consent (KVKK Art. 5/1) |
| Meeting legal obligations, answering requests from authorities | Relevant data | Legal obligation (ç); establishing, exercising or protecting a right (e) |
4. Who we share data with
We share your data only with the service providers needed to run the service, and only as much as needed. Some of these providers have servers outside Türkiye.
| Recipient | Data shared | Why | Location |
|---|---|---|---|
| Hosting (Oracle Cloud) | All data stored in the account | Server and database that run the service | Germany (Frankfurt) |
| Cloudflare | Site traffic, IP address | Speeding up and protecting the site | Abroad |
| Email service (Yandex) | Email address, verification, PIN reset and support emails | Sending email | Abroad |
| Google (Google Sign-In, Google Play) | For Google Sign-In only the sign-in request; for Google Play the purchase token to verify the subscription | Verifying your identity, verifying and managing the subscription | Abroad |
| Push services (Google, Apple, Mozilla) | Only the push subscription address; the notification text does not pass through them | Delivering a “new notification” signal to phones and computers | Abroad |
| AI service provider | Measurement data, maintenance log, aquarium and livestock details; name, email and phone are not sent | Generating aquarium comments | Abroad |
| YouTube / Twitch | Your browser’s IP address and details when you open the live video | Playing the video (only if you turn this feature on) | Abroad |
| jsDelivr | IP address and browser details | Downloading the chart library | Abroad |
| Authorized public authorities | Requested data | Legal obligation | Türkiye |
Transfers abroad are made in line with the conditions and safeguards in Article 9 of the KVKK (for example, the standard contracts published by the Personal Data Protection Board). We do not give or sell your data to third parties for marketing.
5. Google Sign-In and Google user data
Signing in with Google is optional; you can also sign up with your email address or your device number. When you sign in with Google, BluCory receives only the following from your Google account (openid, email and profile scopes):
- Your Google account ID
- Your name
- Your email address and whether Google has verified it
How we use it: only to create your account, recognise you and sign you in, and set the contact email of your account. We do not access Gmail, Drive, contacts, calendar or any other data in your Google account, and we never see your Google password.
How we store it: the Google account ID, name and email are stored with your account in our database (Oracle Cloud, Frankfurt), reached only over encrypted connections. We do not store Google access tokens; they are discarded once sign-in is complete.
Sharing: we do not share, sell or use data received from Google for advertising, and we do not send it to the AI service provider. It only resides with the infrastructure providers needed to run the service (server) listed above, or is disclosed to authorities where the law requires.
Removal and deletion: you can remove the Google link in the app under Settings > Account, and revoke BluCory’s access on the “Third-party access” page of your Google account. When you delete your account, the data received from Google is deleted too.
BluCory’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Premium subscription through Google Play
In the Android app you can buy premium membership as a monthly or yearly subscription through Google Play. Payment is handled by Google Play; your card and bank details are never sent to us. To verify the subscription and follow renewals and cancellations, we receive from Google only the purchase token, the product and the subscription status. When you cancel premium in the app or delete your account, renewal of your Google Play subscription is stopped for future periods.
7. Cookies, data stored on your device and usage statistics
BluCory does not use advertising cookies or third-party trackers (Google Analytics, etc.).
- Essential cookies: the cookie that keeps you signed in, the “remember me” cookie and the cookie that remembers the theme chosen on this device. The app cannot work without them; they do not require consent.
- Preferences stored on your device: display preferences such as dark / light mode are kept only in your browser and are not sent to us.
- Usage statistics: if you give explicit consent, we record which parts of the app are used and for how long, together with your account and a random device ID created in your browser. Nothing you type in fields (name, PIN, notes, email) is recorded. Results are reviewed only in aggregate, to improve the service. You can withdraw your consent at any time in Settings; this does not affect your use of the service.
8. Retention
We keep data only as long as the purpose requires, then delete, destroy or anonymize it.
| Data | Retention |
|---|---|
| Account details, measurement data, user content | While the account is open; deleted immediately when you delete the account; removed from backups within 30 days at the latest |
| Raw measurement records | While the account is open; hourly and daily summaries are kept for charts |
| Sign-in and PIN reset attempts (IP) | 90 days |
| Google account ID | While the account is open; deleted immediately when you remove the Google link |
| Usage statistics | Up to 13 months |
| Notification records | 90 days |
| Support messages | 2 years after resolution |
| Records subject to legal retention (invoices, etc.) | For the period set by the relevant law |
You can delete your account yourself in the app under Settings > Account > Delete my account, or ask us to delete it at [email protected]. When you reset or transfer your device, the measurement data of that device is deleted; your account and aquarium records are kept.
9. Security
We take technical and organizational measures to protect your data against unauthorized access, loss and alteration.
- All communication with the site and the app uses an encrypted connection (HTTPS).
- Your PIN is never stored in plain form, only as a one-way hash.
- Repeated failed sign-in attempts are limited; you are notified when your username or PIN changes or a device is reset.
- The database and private configuration files are not reachable from the internet; only authorized persons can access the data.
- If a data breach occurs, the Board and affected users are notified within the period set by law.
10. Your rights and how to apply
Under Article 11 of the KVKK, you may contact us to:
- learn whether your personal data is processed
- request information if it has been processed
- learn the purpose of processing and whether data is used accordingly
- know the third parties in Türkiye or abroad to whom data is transferred
- request correction of incomplete or inaccurate data
- request deletion or destruction under the conditions in Article 7 of the KVKK
- request that corrections, deletions and destructions be notified to third parties to whom the data was transferred
- object to a result against you arising solely from automated analysis
- claim compensation for damage caused by unlawful processing
How to apply: send your request, stating your identity and your account (username), to [email protected] from the email address registered to your account. We will respond free of charge within 30 days at the latest. If your request is rejected, you find the answer insufficient, or no answer is given in time, you may file a complaint with the Personal Data Protection Board.
11. Children
BluCory is not directed at children and does not knowingly collect personal data from children under 13.
12. Changes and contact
Questions: [email protected]
We may update this notice when needed; the current version is always published on this page.